Data regulation in India

Context: The Joint Parliamentary Committee (JPC) on Personal Data Protection (PDP) bill is finally ready to table its report during the winter session of the Parliament.

• The JPC has prescribed a phased approach to implementing provisions of the bill. The Act will be fully active in two years.

Major recommendations of the JPC

• The JPC has recommended that the bill should be called the Data Protection Bill, and its scope widened.
• It said the bill should cover not just personal data within its purview, but also non-personal data and non-personal data breaches.
• Non-personal data breaches include any unauthorized acquisition, sharing, use, alteration, destruction, or loss of access to such data that compromises the confidentiality, integrity, or availability of this data.
• Accidental disclosure of non-personal data, including breaches resulting from a lack of proper compliance measures, are also covered under such breaches.
• The JPC has recommended that social media firms shouldn’t be allowed to function in India without setting up offices here.
• Firms that do not operate as intermediaries should be treated as publishers, who will be accountable for the content distributed on their platforms.
• Creating an alternative payment system to SWIFT for cross-border payments, digital certification of Internet of Things (IoT) and other digital devices by the DPA, and localization of sensitive data.
• Chairpersons and members of the Data Protection Authority (DPA) should be appointed within three months, and the DPA should start work under the Act and register data fiduciaries in six and nine months, respectively.

What is non-personal data, and what is the issue related to it?

• All data that doesn’t personally identify a user is known as non-personal data. For instance, an anonymized data set showing the preferences of users in a particular city or state can fall under non-personal data.
• Earlier, a draft report released by the Kris Gopalakrishnan committee had suggested that non-personal data should be provided to domestic companies for building products and services.
• However, it has been opposed by major social media firms, who think it will take away their competitive advantage.